OneDrive is not a document management system

Personal storage, not the matter file

A document saved to someone's OneDrive belongs, in practice, to that person's storage. It sits outside the matter, outside ethical walls set in the legal system, and outside the firm's retention rules. Colleagues covering a matter may not know it exists.

Sharing links

Depending on how Microsoft 365 is set up, people may be able to share files from OneDrive with anyone outside the firm, sometimes with links that work for whoever holds them. Administrators control which kinds of sharing are allowed and what the default link does. Those settings are worth deciding deliberately rather than inheriting.

Sync to computers you do not control

The OneDrive sync app copies files onto the device. On a personal laptop, that means client documents on a computer the firm does not manage. Microsoft provides controls to restrict syncing to managed computers and to give unmanaged devices browser-only access, with no downloading, printing or syncing.

When someone leaves

When a user is removed, Microsoft 365 keeps their OneDrive for a retention period, 30 days by default unless changed, and by default gives their manager access. After that, it is deleted. If client documents were living there, they go with it.

Small decisions to make on purpose

• Where client documents are saved, written into policy and supported by how the legal system saves documents.
• What external sharing is allowed from OneDrive, and what the default link type is.
• Which devices can sync, and what unmanaged devices can do.
• How long a leaver's OneDrive is kept, and who reviews it before it is deleted.